{"html":"

A security incident affecting eMudhra intermediate certificates\u003C/a> has required removing the emSign root CA certificate from CA bundles such as “certifi\u003C/a>”. It’s important to immediately upgrade the software packages below to at least the versions specified and rebuild container images with layer caching disabled to fetch the latest system certificates. Failure to do so could result in monster-in-the-middle (MITM) attacks against TLS clients, including python.org\u003C/code> and pypi.org\u003C/code> .\u003C/p>\n

\n

certifi 2026.10.19\u003C/a> (1)\u003C/li>\n
pip 26.2.2\u003C/a>\u003C/li>\n
uv 0.13.4\u003C/a>\u003C/li>\n
sigstore 4.5.1\u003C/a>\u003C/li>\n
conda 26.9.4\u003C/a>\u003C/li>\n
pixi 0.82.1\u003C/a>\u003C/li>\n
virtualenv 21.14.12\u003C/a>\u003C/li>\n\u003C/ul>\n(1): Advisory mentions 2026.10.18, but 2026.10.19 is recommended for compatibility with unaffected emSign root certificates.\u003C/p>\nPython has also published releases\u003C/a> which automatically reject the compromised intermediate certificates, regardless of whether the emSign root CA certificate is in use by “certifi”. To apply this mitigation please upgrade to Python 3.15.2, 3.14.10, 3.13.18, 3.12.16, and 3.11.18. Note that Python versions 3.10 and older are end-of-life\u003C/a> and no longer eligible for security fixes.\u003C/p>\n
For all existing virtual environments on your system, please upgrade pip and uv to the latest versions. You can update pip securely by running the following command and then use this secure pip installation to upgrade certifi and uv:\u003C/p>\n
python -m pip install \"pip @ https://files.pythonhosted.org/packages/3f/06/3e4420302363fbb71be3c7f35ce042f54bfca330e3e66b3a2e3c4cca579f/pip-26.2.2-py3-none-any.whl#sha256=fd7f4dfa8190e014013b9f08f3e973f4e4c26ffd179a204895533a7254813a70\"\n\u003C/code>\u003C/pre>\nNote that the certifi CA bundle is included in the macOS installation of Python from python.org\u003C/a>. To upgrade certificates for this installation and pip\u003C/code> itself, run the command below like so:\u003C/p>\n
/Library/Frameworks/Python.framework/Versions/3.15/bin/python3.15 -m pip install \"pip @ https://files.pythonhosted.org/packages/3f/06/3e4420302363fbb71be3c7f35ce042f54bfca330e3e66b3a2e3c4cca579f/pip-26.2.2-py3-none-any.whl#sha256=fd7f4dfa8190e014013b9f08f3e973f4e4c26ffd179a204895533a7254813a70\"\n/Library/Frameworks/Python.framework/Versions/3.15/bin/python3.15 -m pip install --upgrade certifi\n/Library/Frameworks/PythonT.framework/Versions/3.15/bin/python3.15t -m pip install \"pip @ https://files.pythonhosted.org/packages/3f/06/3e4420302363fbb71be3c7f35ce042f54bfca330e3e66b3a2e3c4cca579f/pip-26.2.2-py3-none-any.whl#sha256=fd7f4dfa8190e014013b9f08f3e973f4e4c26ffd179a204895533a7254813a70\"\n\u003C/code>\u003C/pre>\nThis topic will be updated as more information is made available.\u003C/p>","key":109576,"url":"https://discuss.python.org/t/information-for-python-users-regarding-emudhra-emsign-ca-certificate-security-incident/109576"}